JSshell

JSshell - versione 3.1 JSshell - una reverse shell JavaScript. Viene utilizzato per eseguire codice JS in remoto, sfruttare XSS cieco, ... Requisiti: Qualsiasi sistema operativo + Python 2 o Python 3 Novità in JSshell versione 3.1 Aggiornato nella nuova versione di JShell 3.1: Nuovo comando...

xsshunter

OBSOLETO - EXPERIMENTE A NOVA VERSÃO EXPRESS Veja aqui para mais informações: https://github.com/mandatoryprogrammer/xsshunter-express Código Fonte do XSS Hunter Esta é uma versão portátil do código fonte rodando em https://xsshunter.com. É projetada para ser facilmente instalável em qualquer...

malicious-pdf

Generatore di PDF Maligni ☠️ Genera 67 file PDF di test maligni per testare callback di phone-home, SSRF, XSS, XXE, furto di credenziali NTLM e esfiltrazione di dati in visualizzatori PDF, convertitori e applicazioni web. Può essere utilizzato con Burp Collaborator o Interact.sh Utilizzato per...

automatic-api-attack-tool

Strumento Automatico di Attacco API Lo strumento di attacco API personalizzabile di Imperva prende una specifica API come input, e genera ed esegue attacchi basati su di essa come output. Lo strumento è in grado di analizzare una specifica API e creare scenari di attacco fuzzing basati su ciò che...

dalfox

Looking for the Go v2.x version? Dalfox v3 is a complete rewrite in Rust. The Go codebase is preserved on the v2 branch and continues to receive security backports. See SECURITY.md for the support policy. Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickl...

dalfox

Cerchi la versione Go v2.x? Dalfox v3 è una riscrittura completa in Rust. Il codice Go è conservato nel ramo v2 e continua a ricevere backport di sicurezza. Consulta SECURITY.md per la policy di supporto. Dalfox è un potente strumento open-source incentrato sull'automazione, ideale per scansionar...

CVE-2026-32258

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...

JSONBee

JSONBee Ein einsatzbereites JSONP-Endpunkt-Set, um die Content Security Policy verschiedener Websites zu umgehen. Das Tool wurde während der HackIT 2018 in Kiew vorgestellt. Die Präsentation ist hier zu finden keine Ahnung, warum das Format der Folien versaut ist :D:...

reflector

reflector Beschreibung Die Burp Suite-Erweiterung ist in der Lage, reflektiertes XSS auf der Seite in Echtzeit zu finden, während man auf der Webseite surft, und bietet einige Funktionen wie: Hervorhebung der Reflexion im Antwort-Tab. Testen, welche Symbole in dieser Reflexion erlaubt sind. Analy...

CVE-2026-32258 Winter: Stored XSS through Editor Settings custom styles

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...

CVE-2026-32258

Winter CMS (a Laravel-based PHP CMS) versions 1.2.10 through 1.2.12 are vulnerable to stored XSS when authenticated backend users with the backend.manage_editor permission inject malicious code via Editor Settings → Markup Styles . The custom styles are compiled by the LESS parser and rendered un...

pyt

.. image:: https://travis-ci.org/python-security/pyt.svg?branch=master :target: https://travis-ci.org/python-security/pyt .. image:: https://readthedocs.org/projects/pyt/badge/?version=latest :target: http://pyt.readthedocs.io/en/latest/?badge=latest .. image::...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

CVE-2026-32257

Winter CMS is an open-source content management system based on the Laravel PHP framework. Prior to 1.2.13 , custom CSS supplied through the Brand Settings Styles field by a user with the backend.manage_branding permission was compiled by the LESS CSS parser and rendered without sanitization on e...

Tiny-XSS-Payloads

Tiny-XSS-Payloads Eine Sammlung kurzer XSS-Payloads, die in verschiedenen Kontexten verwendet werden können. Die Demo ist hier verfügbar: https://tinyxss.terjanq.me Aktuelle Payloads root@kitploit: ... -- root@kitploit: root@kitploit: root@kitploit: root@kitploit:...

xsscrapy

xsscrapy Spider veloce e approfondito per XSS/SQLi. Fornisci un URL e testerà ogni link trovato per vulnerabilità di cross-site scripting e alcune vulnerabilità di SQL injection. Consulta le FAQ per maggiori dettagli sul rilevamento SQLi. Dalla cartella principale esegui: root@kitploit:...

xssor2

XSS'OR XSS'OR - Hack con JavaScript. ONLINE Puoi provare: https://xssor.io e http://xssor.io/ Contiene tre moduli principali: Encode/Decode, Codz, Probe. INSTALLAZIONE Python 3 con Django 3.0. o Python 2 con Django 1.11. git clone https://github.com/evilcos/xssor2 o scarica direttamente cd xssor2...

awesome-oneliner-bugbounty

Awesome One-liner Bug Bounty Una raccolta di fantastici script one-liner, pensati soprattutto per il bug bounty. Questo repository archivia e ospita vari one-liner con suggerimenti per il bug bounty, forniti da me e contribuiti dalla community. I vostri contributi e suggerimenti sono sinceramente...

CVE-2026-80426

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

CVE-2026-54606

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...